ShinyHunters defaces Clop ransomware leak site via Grav CMS flaw

ShinyHunters has defaced the Clop leak site, the hidden page the Clop ransomware group uses to publish stolen data, saying it broke in through a file upload flaw in the Grav CMS software behind the site. Clop, also written Cl0p, is a long-running ransomware operation that runs a service on the Tor anonymity network where it posts material taken from victims to pressure them into paying. ShinyHunters said the intrusion began on Friday night, and that the page visitors saw was later replaced entirely.

ShinyHunters says it exploited what it describes as an unauthenticated file upload vulnerability in Grav CMS, a type of flaw that in principle lets an attacker place a file on a server without logging in first. The group used that opening to upload a small text file to Clop's site. The file carried a message telling the Clop gang not to threaten them and a link to ShinyHunters' own data leak site. BleepingComputer, which reported the incident on September 19, 2026, said it confirmed that the file had been placed on Clop's server and could be downloaded directly from the gang's Tor site.

Several hours after that file appeared, ShinyHunters told BleepingComputer it had completely defaced the Clop site. A visit to the address showed the original page replaced by artwork built from keyboard characters (ASCII art), spelling out an image of Umbreon, the Pokémon the group uses as its logo, together with a link to its own Tor site and the line "rooting your systems since '19 ;)". According to ShinyHunters, the defaced page was still being served from Clop's own infrastructure at the time of writing. The cybersecurity researcher VXDB told BleepingComputer that the Umbreon artwork is the same as the one used in the August 2020 defacement of the HackForums website, an attack ShinyHunters also claimed at the time.

ShinyHunters claims it gained full access to the server and copied source code, Grav CMS plugins, system logs and other material. "The data we stole includes source codes, gravCMS plugins, and other things. We are still downloading and reviewing them," the group told BleepingComputer. It also says it took every file stored under /var/log, the folder on a Linux server where activity records are normally kept. Such records can hold a history of who signed in and when, and potentially the IP addresses (the numeric labels that identify internet connections) of people who connected to the machine. ShinyHunters additionally claims to have obtained the private keys for Clop's Tor onion service, which are the cryptographic credentials that prove ownership of a hidden site address. "We have their onion keys. So if they kick us out it wouldn't matter at all because we control the private keys to host the same exact onion URL," the group said. If those keys are genuine, they would let ShinyHunters run a hidden site at Clop's existing onion address from servers they control. BleepingComputer stated that it independently confirmed the defacement and the earlier uploaded file, but had not verified the claims about stolen logs, source code or onion private keys.

The group presents the attack as retaliation. ShinyHunters says a Clop representative threatened to identify its members and made violent threats after ShinyHunters disrupted a Clop data theft campaign, and that the dispute goes back to Clop's 2025 campaign against the enterprise applications suite from the vendor that also sells a widely used relational database. In October 2025, Clop exploited several vulnerabilities in servers running that enterprise applications suite, including a zero-day tracked as CVE-2025-61882, to steal data from organizations in extortion campaigns. Around the same period, attackers calling themselves "Scattered Lapsus$ Hunters", a grouping that includes ShinyHunters, published a proof-of-concept exploit that the vendor later confirmed matched an exploit used in the Clop attacks. ShinyHunters said at the time that the exploit had originally been theirs and that Clop had obtained it without authorization. ShinyHunters also said a Clop representative sent it a message which, translated from Russian, read: "I have more money than you and all of your people combined, I'll kill you soon." BleepingComputer said it had not independently verified those allegations and had contacted Clop for comment. Asked what it intended to do with the material it says it holds, ShinyHunters answered: "Going to extort them." The group says it plans to publish a message on its own leak site telling Clop to get in touch within 72 hours.

For website owners and IT teams, the instructive part of this episode is the entry point rather than the dispute between the two groups. An unauthenticated file upload flaw is a recurring class of bug in content management systems and their add-ons: it allows a stranger to write a file onto a web server, which is often enough to place a script that runs with the website's own permissions or to swap out a page visibly. Because the flaw needs no login, an unpatched site can be touched by automated scanning within hours of a vulnerability becoming known. ShinyHunters says it also gathered the server's activity records, which underlines a second lesson: logs are not just for troubleshooting. They show who reached a machine and from where, so they are valuable to an attacker, and equally valuable to a defender trying to work out whether an intrusion happened. The claim about onion private keys points to a third issue, the careful handling of the secret credentials that identify a service, since copying them can allow someone else to impersonate that service elsewhere.

It is worth being clear about what is established and what is not. The defacement of Clop's leak site and the uploading of a text file to its server were confirmed by BleepingComputer, the outlet that reported the story, and the Umbreon artwork has been linked to an earlier defacement by a researcher. The claims about stolen source code, server logs and onion private keys rest on ShinyHunters' own statements and remain unverified, and the account of threats between the two groups is likewise the group's own version of events. BleepingComputer says it has contacted Clop and will update the story if it receives a response, so parts of this picture may still change.

Websites built on a content management system live or fall by a steady routine of updates, and for readers who would rather not track those releases themselves, AEU Hosting offers managed WordPress hosting in which the platform and its updates are handled as part of the service, so that routine upkeep is not left to chance. Whether a site runs on WordPress or another platform, the practical questions raised by this story are the same: is the software current, are upload features limited to what the site actually needs, and would anyone notice if a page or a file changed without permission?